Repository navigation
v0.17.3 #65
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Windows Release | |
| on: | |
| release: | |
| types: [published] | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-upload: | |
| # Runner must be windows/x64 with PowerShell, Docker, and rustup. | |
| runs-on: [self-hosted, windows, x64] | |
| timeout-minutes: 90 | |
| permissions: | |
| contents: write | |
| # Source the tag from the github context (evaluated by Actions) rather than | |
| # $env:GITHUB_REF_NAME, which is only injected by runner >= 2.290. Keeps the | |
| # build working on older self-hosted runners. (#212 follow-up) | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| defaults: | |
| run: | |
| shell: powershell | |
| steps: | |
| - name: clean workspace | |
| run: | | |
| Remove-Item -Recurse -Force .build, dist -ErrorAction SilentlyContinue | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: write version files | |
| run: | | |
| $tag = $env:REF_NAME | |
| if (-not $tag) { throw "REF_NAME is not set" } | |
| $version = $tag -replace '^v', '' | |
| $json = "{`"version`": `"$version`"}" | |
| Set-Content -Path "static/version.json" -Value $json -Encoding UTF8 | |
| (Get-Content "desktop/src-tauri/Cargo.toml") -replace '^version = ".*"', "version = `"$version`"" | | |
| Set-Content "desktop/src-tauri/Cargo.toml" | |
| (Get-Content "desktop/src-tauri/tauri.conf.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" | | |
| Set-Content "desktop/src-tauri/tauri.conf.json" | |
| (Get-Content "pyproject.toml") -replace '^version = ".*"', "version = `"$version`"" | | |
| Set-Content "pyproject.toml" | |
| (Get-Content "desktop/package.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" | | |
| Set-Content "desktop/package.json" | |
| Write-Host "Wrote version $version to all version files" | |
| - name: build Windows NVIDIA | |
| run: | | |
| powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 ` | |
| -PackageName StemDeck-Windows-x64.NVIDIA ` | |
| -PackageVersion "$env:REF_NAME" | |
| - name: build Windows CPU | |
| run: | | |
| powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 ` | |
| -PackageName StemDeck-Windows-x64 ` | |
| -PackageVersion "$env:REF_NAME" ` | |
| -CpuOnly ` | |
| -PublishUpdaterAssets | |
| - name: scan artifacts | |
| run: | | |
| Write-Host "Preparing ClamAV scan for Windows release artifacts..." | |
| Write-Host "Artifacts staged in: $PWD\dist" | |
| Get-ChildItem -Path "dist" -File | | |
| Sort-Object Name | | |
| Select-Object Name, | |
| @{Name="SizeMB"; Expression={ [math]::Round($_.Length / 1MB, 2) }} | | |
| Format-Table -AutoSize | |
| Write-Host "SHA256 checksums:" | |
| Get-ChildItem -Path "dist" -Filter "*.zip" -File | | |
| Sort-Object Name | | |
| ForEach-Object { | |
| $hash = Get-FileHash -Algorithm SHA256 $_.FullName | |
| Write-Host " $($hash.Hash) $($_.Name)" | |
| } | |
| Write-Host "Pulling latest ClamAV scanner image..." | |
| docker pull clamav/clamav:latest | |
| Write-Host "Running ClamAV scan over dist/..." | |
| docker run --rm -v "${PWD}/dist:/scan:ro" clamav/clamav:latest ` | |
| clamscan --recursive --infected --bell /scan | |
| if ($LASTEXITCODE -ne 0) { | |
| throw "ClamAV scan failed or reported infected files. Exit code: $LASTEXITCODE" | |
| } | |
| Write-Host "ClamAV scan completed successfully. No infected files reported." | |
| # See the same guard in linux-release.yml: action-gh-release silently | |
| # tolerates missing files, so an absent updater asset shipped a green | |
| # release the in-app updater could not use. | |
| - name: verify every asset exists | |
| shell: powershell | |
| run: | | |
| $required = @( | |
| "dist/StemDeck-Windows-x64.NVIDIA.zip", | |
| "dist/StemDeck-Windows-x64.NVIDIA.zip.sha256", | |
| "dist/StemDeck-Windows-x64.zip", | |
| "dist/StemDeck-Windows-x64.zip.sha256", | |
| "dist/StemDeck-Windows-x64-app.zip", | |
| "dist/StemDeck-Windows-x64-app.zip.sha256", | |
| "dist/StemDeck-Windows-x64-runtime-version.json" | |
| ) | |
| foreach ($f in $required) { | |
| if (-not (Test-Path $f)) { Write-Error "missing release asset: $f"; exit 1 } | |
| } | |
| - name: upload artifacts | |
| uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 | |
| with: | |
| # Carry the release's own flag. The action defaults `prerelease` to | |
| # false and writes it back, so attaching assets silently promoted a | |
| # pre-release to the latest release -- which also fires `released`, | |
| # pushing :latest to GHCR, and makes the in-app updater offer a build | |
| # that was never verified. | |
| prerelease: ${{ github.event.release.prerelease }} | |
| fail_on_unmatched_files: true | |
| files: | | |
| dist/StemDeck-Windows-x64.NVIDIA.zip | |
| dist/StemDeck-Windows-x64.NVIDIA.zip.sha256 | |
| dist/StemDeck-Windows-x64.zip | |
| dist/StemDeck-Windows-x64.zip.sha256 | |
| dist/StemDeck-Windows-x64-app.zip | |
| dist/StemDeck-Windows-x64-app.zip.sha256 | |
| dist/StemDeck-Windows-x64-runtime-version.json |